MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9bb5304497e3de141d6cc8e08a9f6d4937aa271e0718b4e7cb3f11023b5f7d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9bb5304497e3de141d6cc8e08a9f6d4937aa271e0718b4e7cb3f11023b5f7d4
SHA3-384 hash: 10b0b8073c26ade78e5e1d9a8938a48cc9ddaf45ca039ae0fdecd3debd476b5b25ef31f0ec4e4da15ea9b9ddb3461007
SHA1 hash: 6e466573bdf6dcbcb4d9c2a2cb1f7eb5c02439e9
MD5 hash: 645a0389c6c4778472dc2cce864acb64
humanhash: thirteen-green-jupiter-nine
File name:645a0389c6c4778472dc2cce864acb64
Download: download sample
Signature Formbook
Create hunting rule
File size:182'585 bytes
First seen:2020-10-25 08:00:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:prONdk+8jA0pdZYpxXOImxORdWjLZApuRCfaSal5fsU/yI3w:UCsaK9OIKEIjlApuRCfG9sU/yI
TLSH 6A04AE32D641C035F2B241B9F67D0B7B883D0D383295A4EAE7E116A06EA45E5F53A31F
Reporter seifreed
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75437/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Banker1.29984.UNOFFICIAL
Create hunting rule

Win.Malware.Formbook-7399661-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/509162
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d9bb5304497e3de141d6cc8e08a9f6d4937aa271e0718b4e7cb3f11023b5f7d4/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 10:36:27 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201025-e6aqwhc21x/
Malware Config
C2 Extraction:
http://www.regulars5.com/nvqj/
Unpacked files
SH256 hash:
d9bb5304497e3de141d6cc8e08a9f6d4937aa271e0718b4e7cb3f11023b5f7d4
MD5 hash:
645a0389c6c4778472dc2cce864acb64
SHA1 hash:
6e466573bdf6dcbcb4d9c2a2cb1f7eb5c02439e9
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/8438d44a-1628-4c48-8374-b0fc9d6477ee/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d9bb5304497e3de141d6cc8e08a9f6d4937aa271e0718b4e7cb3f11023b5f7d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Formbook
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Formbook in memory
Reference:internal research
Rule name:win_formbook_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/413340/
Cape
Cape
https://www.capesandbox.com/analysis/75437/

Comments